Trust is the product.
Diagnosly runs on your PC and reads diagnostic detail from it. This page says exactly what leaves your machine, how it is protected and where our limits are.
At a glance
You approve every change
Diagnosly proposes fixes and waits. Anything that modifies your system runs only after you say yes, with a restore point taken first.
Scrubbed before it leaves
Account names, machine names, email addresses, private IPs and secrets are replaced on your PC, before anything is sent.
Never sold, never used for training
We do not sell your data, and your diagnosis data is not used to train AI models. The Privacy Policy is the binding version of that promise.
Sign-in with SSO and MFA
Google sign-in or email, with optional two-step verification on your account. Teams get SAML and OpenID Connect single sign-on, SCIM provisioning and required multi-factor authentication.
Found a problem? Tell us
Report a vulnerability and we will acknowledge it, keep you updated while we fix it, and credit you if you wish.
Straight about the gaps
We list what we have not done yet, including code signing and independent certification, in plain view on this page.
What leaves your PC
The agent checks in with our servers so the app knows your PC is online. This is what happens to the diagnostic detail it gathers when you run a diagnosis.
- You describe the problem In the Personal app, by typing or speaking. Speech is turned into text on your PC and the audio is not uploaded.
- The agent looks at your PC A small background service reads event logs, performance counters, drivers and settings locally.
- It scrubs what it found Personal details are replaced with placeholders on your PC. Only the scrubbed result continues.
- It is sent over HTTPS To our gateway at api.diagnosly.app, through Cloudflare. All traffic is encrypted in transit.
- An AI model analyses it Our gateway passes the scrubbed data to the model provider and keeps our provider keys on our side. They never reach your PC.
- You review and approve The app shows the cause and the proposed fixes. Approved fixes run on your PC, and the whole run is kept in your history.
We do not sell your data and we do not use your telemetry or diagnosis data to train AI models. How long things are kept and how to ask for deletion are covered in the Privacy Policy.
Personal details are scrubbed on your PC
The scrubber runs inside the agent, before the network call, on command output, event messages and the results of the AI’s tool calls. Matches are replaced with placeholders, so a diagnosis stays useful without carrying who you are.
| What is found | Looks like | Replaced with |
|---|---|---|
| Email addresses | alex@example.com | <EMAIL> |
| Your name in user folders | C:\Users\alex\Documents | C:\Users\<USER>\Documents |
| Domain accounts | CONTOSO\alex | <DOMAIN_USER> |
| This PC’s name | ALEX-LAPTOP-7 | <HOSTNAME> |
| Network share paths | \\server\finance | <UNC> |
| MAC addresses | 00:1A:2B:3C:4D:5E | <MAC> |
| Private and loopback IPs | 192.168.1.20 | <RFC1918_IP> |
| Windows security IDs | S-1-5-21-… | <SID:…> (a stable hash) |
| GUIDs | 3f2504e0-4f89-… | <GUID:…> (a stable hash) |
| Windows product keys | XXXXX-XXXXX-… | <PRODUCT_KEY> |
| BitLocker recovery keys | 48 digits | <BITLOCKER_KEY> |
| Secrets next to words like password, token or api_key | token = 9f8e… | <SECRET> |
What the scrubber does not cover
It is defence in depth, not a guarantee. It matches known patterns, so it cannot recognise every kind of personal detail. It does not alter the text you type to describe a problem, so avoid pasting passwords there. Your public IP address is visible to our servers, as it is to any website you visit, and the PC’s name is sent once when the agent first registers.
On the server side, the gateway checks command results for unscrubbed patterns and records only the categories it found and the size of the output, never the values themselves.
You stay in control of changes
- Approval first. The AI proposes a checklist of changes. Anything that modifies your system, such as driver installs, registry edits, service changes or uninstalls, is explained to you and waits for your approval.
- A restore point before risky fixes. Before an approved change runs, Diagnosly turns on System Protection if it is off, lifts Windows’ one-restore-point-a-day limit so the new one is not skipped, creates a restore point and checks that it really exists. If Windows cannot make one, it says so and saves a snapshot of the affected services, scheduled tasks and startup settings instead. If neither is possible, it warns you and carries on with per-action backups only, rather than claiming a safety net it does not have.
- Cancel any time. A running diagnosis has a Cancel button.
- A full history. What was checked and what was changed is kept in your history for every diagnosis.
The agent runs as a Windows service with administrator-level rights, because reading system logs and applying approved fixes needs them. The approval step is how that power stays under your control. Approval comes from how the AI is instructed and from the app’s interface, while the restore point step is enforced by the agent itself rather than left to the AI. These are product safeguards, not a security sandbox.
How it is protected
- In transit. Everything between the agent, the app, the website and our servers travels over HTTPS through Cloudflare.
- Secrets at rest. API keys and similar secrets stored in our database are encrypted (Fernet: AES-128 with HMAC-SHA256) with a dedicated key that is held outside the database.
- Passwords. Stored only as salted bcrypt hashes. We cannot read your password.
- On your PC. The agent’s configuration file, which holds its connection token, is locked down to the system and administrators. The Personal app keeps your sign-in token in the Windows credential store.
- Updates. Personal app updates are signed, and the app checks the signature before installing. The background agent’s updates are checksum-verified.
- AI provider keys stay with us. Our model-provider keys live on our servers. Your PC talks to our gateway, which makes the call, so the keys are never sent to your machine.
- Payments. Card details are handled by Stripe. They never touch our servers.
- Web hardening. HSTS, content-type protection, clickjacking protection and a restrictive permissions policy on our sites, plus a strict content security policy on the API. Sign-in and sign-up are rate limited.
- Reviews. We run internal security reviews and fix what they find, and we say so in the changelog.
Sign-in, SSO and MFA
How you prove who you are depends on whether you use Diagnosly for yourself or for a team.
Personal accounts
- Sign in with Google (OpenID Connect), or with an email address and password
- Email sign-ups must verify their address first, and passwords are stored only as salted bcrypt hashes
- Sessions use an
HttpOnly,Secure,SameSite=Laxcookie and can be revoked - Opening the app from the website uses a one-time code, so credentials never travel in a link
- One Windows PC per account. Moving to another PC is a deliberate step in the app
- Optional two-step verification for email and password accounts, using an authenticator app plus single-use recovery codes. Google accounts use Google’s own two-step sign-in
- Five wrong codes lock the account out for five minutes, and each code and sign-in attempt can be used only once
Teams
- SAML 2.0 and OpenID Connect single sign-on, validated for signature, issuer, audience and expiry
- SCIM 2.0 provisioning of users and groups with scoped tokens
- Multi-factor authentication with an authenticator app, optional or required per organisation
- Sign-in lockout after repeated failed attempts
For teams
Diagnosly for teams adds the controls an organisation expects. See the teams page for the product.
Control and records
- Three roles: admin, tech and viewer
- Plan-based feature gates enforced on the server
- An audit log of sign-ins, diagnoses, script runs and key settings, exportable as CSV
- Retention is configurable per organisation, one year by default
Isolation between organisations
Every query is scoped to the organisation it belongs to, and access to another organisation’s devices returns not found. This is enforced in the application layer, not by database row-level security, and it is covered by automated checks and by our internal reviews.
What our own people can see
Platform operators can see account metadata for support and billing: the users on an account, its devices and agent versions, its credit balance, and the size and cost of AI calls. They cannot sign in as you, and the staff tools do not expose the contents of your diagnoses or telemetry. Staff actions are logged.
People with access to our servers are outside what this page can prove from software alone, which is why we keep that access small and say so here.
Providers we rely on
| Provider | What for |
|---|---|
| Cloudflare | DNS, TLS and edge networking |
| Oracle Cloud | Compute and the primary database |
| Vercel | Hosting for this website |
| Stripe | Payments |
| Resend | Account and receipt emails |
| Sign-in, if you choose it | |
| AI model providers | Analysing scrubbed diagnostic data to produce a diagnosis, as named in the Privacy Policy |
| Plausible | Privacy-friendly website analytics |
| Google Fonts | Typefaces for this website |
The Privacy Policy explains how each provider that handles your personal data is used.
What we have not done yet
- Code signing. The installer and agent are not yet signed with a Windows code-signing certificate, so SmartScreen may show an unknown publisher warning. Personal app updates are signed, but the Windows installer itself is not. Until it is, we publish the SHA-256 hash of each installer on the Get started page so you can check your download.
- Independent certification. We do not hold SOC 2 or ISO 27001, and we have not commissioned an independent penetration test. Our reviews so far are internal.
- Browser policy. The content security policy on the website is in report-only mode while we tighten it.
We would rather you read this here than find it out later. As these change, this page changes too, and the date at the top moves with it.
Reporting a vulnerability
Email security@diagnosly.app with what you found and how to reproduce it. We will acknowledge your report, keep you updated while we fix it, and credit you in the changelog if you would like that.
Please give us a reasonable chance to fix an issue before you share it publicly, and avoid accessing other people’s data while you test. Our security.txt has the same details in machine-readable form.